CVE-2026-48172

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 17.92%
EPSS Percentile: 97.18%
CISA KEV: YES — Known Exploited Vulnerability

Description

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 21-May-2026 09:16
Last Modified: 08-Oct-2026 02:17
EPSS Date: 2026-10-30
CWE: CWE-266

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2026-05-26
Remediation Due: 2026-05-29
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-48172

Affected Products / Versions

litespeedtech / litespeed_cpanel_plugin Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.4.7
cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin:*:*:*:*:*:*:*:*
litespeedtech / litespeed_whm_plugin Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 5.3.1.0
cpe:2.3:a:litespeedtech:litespeed_whm_plugin:*:*:*:*:*:*:*:*

References

Last enrichment sync: 31-Oct-2026 06:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The issue, tracked as CVE-2026-48172 and reported by Namecheap, can let attackers with FTP or web shell access escalate to root on shared hosting servers running CloudLinux/CageFS. CISA Orders Federal Agencies to Patch Actively Exploited LiteSpeed cPanel Flaw
The vulnerability, tracked as CVE-2026-48172, can let unauthenticated attackers run arbitrary scripts with root privileges, and users are urged to update immediately or block suspicious IPs. CISA Orders Federal Agencies to Patch Actively Exploited LiteSpeed cPanel Flaw
Tracked as CVE-2026-48172 (CVSS score of 9.8), the flaw is described as a privilege escalation issue that could allow attackers to execute arbitrary scripts with root privileges. CISA Urges Patching of Actively Exploited LiteSpeed cPanel Plugin Flaw
LiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root. LiteSpeed Says CVE-2026-48172 in cPanel Plugin Is Actively Exploited to Run Scripts as Root

CVE (1)

Malware (2)

People (1)

MITRE ATT&CK (1)

Vendors (2)

Products (10)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.